General

  • Target

    81803baf631affc9364f0f76ce321500c956a1d363df083181b66c44ab95655b

  • Size

    1.1MB

  • Sample

    241106-kp4gsaxfkj

  • MD5

    4ae4eb6146e07f848919b0836729b76d

  • SHA1

    076337fb64d36d81f264baa8989bfda271b97c02

  • SHA256

    81803baf631affc9364f0f76ce321500c956a1d363df083181b66c44ab95655b

  • SHA512

    5fdf30b2a9eaa2c29e82e0c997c0e19a4a2aa42fa2e004bed0b27b1710d4e2fb768102fec9683d41f6d8bed5db798a521157f9d1b7de6a01f59e75a859085cc6

  • SSDEEP

    24576:NyVGtfimTKaE9hwgiPJEw9sEFfyPDdKipnEaoCl9:octaYKNiPuw9jyr06Lo

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diro

C2

185.161.248.90:4125

Attributes
  • auth_value

    ae95bda0dd2e95169886a3a68138568b

Targets

    • Target

      81803baf631affc9364f0f76ce321500c956a1d363df083181b66c44ab95655b

    • Size

      1.1MB

    • MD5

      4ae4eb6146e07f848919b0836729b76d

    • SHA1

      076337fb64d36d81f264baa8989bfda271b97c02

    • SHA256

      81803baf631affc9364f0f76ce321500c956a1d363df083181b66c44ab95655b

    • SHA512

      5fdf30b2a9eaa2c29e82e0c997c0e19a4a2aa42fa2e004bed0b27b1710d4e2fb768102fec9683d41f6d8bed5db798a521157f9d1b7de6a01f59e75a859085cc6

    • SSDEEP

      24576:NyVGtfimTKaE9hwgiPJEw9sEFfyPDdKipnEaoCl9:octaYKNiPuw9jyr06Lo

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks